PT-2023-20504 · Raysan5 · Raylib

Eugene Lim · Publicado 2023-04-14 · Atualizado 2023-04-21 · CVE-2023-26123

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions raysan5/raylib versions prior to 4.5.0

Description The issue is related to Cross-site Scripting (XSS) where the SetClipboardText API does not properly escape the character, allowing attacker-controlled input to break out of the string and execute arbitrary JavaScript via theemscripten run script` function. This vulnerability is present only when compiling raylib for PLATFORM WEB, and all other Desktop/Mobile/Embedded platforms are not affected.

Recommendations For versions prior to 4.5.0, update to version 4.5.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the SetClipboardText API when compiling for PLATFORM WEB until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-26123

Produtos afetados

Raylib

Referências · 7

• 🔥 https://github.com/raysan5/raylib/issues/2954 · Exploit
• 🔥 https://security.snyk.io/vuln/SNYK-UNMANAGED-RAYSAN5RAYLIB-5421188 · Exploit
• https://github.com/raysan5/raylib/releases/tag/4.5.0 · Nota
• https://github.com/raysan5/raylib/commit/b436c8d7e5346a241b00511a11585936895d959d · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-26123 · Nota de Segurança
• https://t.me/cvenotify/48209 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-26123 · Aviso do Fabricante